Vulnerability Research Plan: CVE-2026-2890 Payment Integrity Bypass

1. Vulnerability Summary

The Formidable Forms plugin (up to version 6.28) contains a flaw in its Stripe Lite payment integration. The function handle_one_time_stripe_link_return_url processes successful payment returns but fails to verify that the amount associated with the Stripe PaymentIntent matches the expected amount for the specific form entry being processed. Furthermore, the verify_intent() function only checks if the user possesses the client_secret for a given PaymentIntent, without ensuring that the intent is bound to the current transaction, form, or entry.

This allow an unauthenticated attacker to complete a low-value payment (e.g., $1.00), obtain the resulting PaymentIntent ID and client_secret, and then reuse those credentials to "complete" a high-value payment (e.g., $1,000.00) for a different form submission.

2. Attack Vector Analysis

• Endpoint: The return URL handler for Stripe Link payments. This is typically triggered via an init hook or a specific listener that looks for the frm_stripe_return or frm_stripe_link_return parameter in a GET request.
• Vulnerable Functions: handle_one_time_stripe_link_return_url and verify_intent().
• Payload Parameters:
  • payment_intent: The ID of a previously succeeded low-value payment.
  • payment_intent_client_secret: The secret associated with the low-value payment.
  • form_id or entry_id: The ID of the high-value submission to be "paid."
• Authentication: Unauthenticated.
• Preconditions:
  • Stripe Lite must be enabled in Formidable Settings.
  • A form must exist that accepts payments.

3. Code Flow (Inferred from Patch Description)

1. Entry Point: A user submits a Formidable Form configured for payment. An entry is created with a pending status.
2. Payment Redirect: The plugin redirects the user to Stripe or provides a Stripe Link.
3. Completion Handler: After "payment," the user is redirected back to a URL like:
   https://victim.com/?frm_stripe_return=1&payment_intent=pi_123&payment_intent_client_secret=pi_123_secret_abc&entry=456
4. Validation Logic:
   • handle_one_time_stripe_link_return_url() is triggered.
   • It calls verify_intent($intent_id, $client_secret).
   • verify_intent checks if the client_secret matches the intent_id (by querying Stripe API). It returns true because the attacker is using a valid secret for a valid intent.
   • The handler checks if $intent->status === 'succeeded'.
   • Vulnerable Step: It finds the entry (e.g., ID 456) and marks it as Paid/Complete without checking if $intent->amount equals the price of the item in entry 456.

4. Nonce Acquisition Strategy

Based on the provided source code, payment nonces are likely handled within the Stripe-specific controllers (e.g., FrmTransLiteController or FrmStripeLiteController), which are not in the provided snippet. However, Stripe return handlers often bypass traditional WordPress nonces because they are intended for callbacks from external services.

If a nonce is required for the initial form submission (frm_entries_create):

1. Shortcode: The form is rendered via the [formidable id=X] shortcode.
2. Page Navigation: Navigate to the page containing the payment form using browser_navigate.
3. Extraction: Use browser_eval to extract nonces.
   • Variable: frmStripeVars (standard for this plugin's Stripe integration).
   • Command: browser_eval("window.frmStripeVars?.nonce") or browser_eval("jQuery('input[name=\"_wpnonce\"]').val()").

5. Exploitation Strategy

The goal is to use a completed $1.00 transaction ID to satisfy a $100.00 requirement.

Step 1: Obtain a Successful PaymentIntent (Low Value)

1. Submit a form configured for a $1.00 payment (Form A).
2. Complete the payment flow legitimately.
3. Capture the payment_intent (e.g., pi_LOWVALUE) and payment_intent_client_secret (e.g., pi_LOWVALUE_secret_XYZ) from the redirect URL.

Step 2: Create a High-Value Submission

1. Submit a form configured for a $1000.00 payment (Form B).
2. Capture the entry_id (e.g., 789) created by this submission.
3. When the plugin expects you to pay for Form B, stop and do not pay.

Step 3: Trigger the Bypass

Send a GET request to the return handler using the credentials from Step 1 against the ID from Step 2.

Request Configuration:

• URL: http://localhost:8080/
• Method: GET
• Parameters:
  • frm_stripe_return: 1 (or the parameter that triggers handle_one_time_stripe_link_return_url)
  • payment_intent: pi_LOWVALUE
  • payment_intent_client_secret: pi_LOWVALUE_secret_XYZ
  • entry: 789 (The high-value entry ID)

6. Test Data Setup

1. Form A (Cheap): Create a form (ID: 1) with a single Payment field set to a fixed amount of $1.00. Enable Stripe Lite.
2. Form B (Expensive): Create a form (ID: 2) with a Payment field set to $1000.00.
3. Stripe Mock: In a test environment, ensure Stripe is in "Test Mode" so pi_ IDs can be generated without real money.

7. Expected Results

• The HTTP response from the bypass request should indicate a successful redirect (302) to the form's "Success" page.
• The entry with ID 789 (High Value) should now have a transaction status of complete or Paid in the database, despite no payment being made for that specific amount.

8. Verification Steps

1. WP-CLI Entry Check:
   wp formidable entry get 789 --field=is_draft
   (Confirm it is no longer a draft/pending).
2. Database Transaction Check:
   wp db query "SELECT * FROM wp_frm_payments WHERE item_id=789;"
   (Verify a payment record exists and is marked as 'complete').
3. Amount Comparison:
   Check if the wp_frm_payments record shows the amount from the PaymentIntent ($1.00) while the form entry is for $1000.00.

9. Alternative Approaches

If the entry ID is not passed via GET, it may be stored in the PHP Session or the Stripe PaymentIntent metadata.

• Metadata Check: If the plugin relies on metadata saved on the Intent at creation, this bypass is only possible if the plugin fails to verify the amount field of the Intent against the price defined in the Form.
• Action Verification: If the init hook fails, try targeting the AJAX handler for Stripe returns:
  action=frm_stripe_link_return&payment_intent=...&... via admin-ajax.php.